Add compact_sequence_indent option for YAML stores

Expose the Go yaml.v3 CompactSeqIndent() encoder setting,
which treats '- ' as part of the indentation. With indent: 2,
this produces sequences flush with their parent key, matching
the style expected by yamlfmt and yamllint.

Configurable via .sops.yaml or --compact-sequence-indent flag.

Refs #514, #864, #1066

Signed-off-by: david amick <david@davidamick.com>

Author: snarlysodboxer

README.rst

@@ -1442,6 +1442,25 @@ by configuring ``.sops.yaml`` with:
   The YAML emitter used by SOPS only supports values between 2 and 9. If you specify 1,
   or 10 and larger, the indent will be 2.
 
+When ``compact_array_indent`` is enabled, the array indicator (``"- "``) is considered
+part of the indentation. Combined with ``indent: 2``, this produces output where arrays are
+flush with their parent key, matching the style used in Kubernetes manifests and YAML linters:
+
+.. code:: yaml
+
+  spec:
+    rules:
+    - host: example.com
+
+You can enable this with the ``--compact-array-indent`` CLI option or by configuring
+``.sops.yaml`` with:
+
+.. code:: yaml
+
+  stores:
+      yaml:
+          compact_array_indent: true
+
 YAML anchors
 ~~~~~~~~~~~~
 
@@ -2110,6 +2129,10 @@ The store configuration object can have the following keys:
     The YAML emitter used by sops only supports values between ``2`` and ``9``.
     If you specify ``1``, or ``10`` and larger, the indent will be ``2``.
 
+  * ``compact_array_indent`` (boolean; default ``false``): when enabled, the array
+    indicator (``"- "``) is considered part of the indentation. Combined with ``indent: 2``,
+    this produces output where arrays are flush with their parent key.
+
 Encryption Protocol
 -------------------
 

cmd/sops/main.go

@@ -1863,6 +1863,10 @@ func main() {
 			Name:  "indent",
 			Usage: "the number of spaces to indent YAML or JSON encoded file",
 		},
+		cli.BoolFlag{
+			Name:  "compact-array-indent",
+			Usage: "use compact YAML array indentation where '- ' is considered part of the indentation",
+		},
 		cli.BoolFlag{
 			Name:  "verbose",
 			Usage: "Enable verbose logging output",
@@ -2394,6 +2398,9 @@ func outputStore(context *cli.Context, path string) (common.Store, error) {
 		storesConf.JSON.Indent = indent
 		storesConf.JSONBinary.Indent = indent
 	}
+	if context.GlobalBool("compact-array-indent") {
+		storesConf.YAML.CompactArrayIndent = true
+	}
 
 	return common.DefaultStoreForPathOrFormat(storesConf, path, context.String("output-type")), nil
 }

config/config.go

@@ -112,7 +112,8 @@ type JSONBinaryStoreConfig struct {
 }
 
 type YAMLStoreConfig struct {
-	Indent int `yaml:"indent"`
+	Indent             int  `yaml:"indent"`
+	CompactArrayIndent bool `yaml:"compact_array_indent"`
 }
 
 type StoresConfig struct {

stores/yaml/store.go

@@ -397,6 +397,9 @@ func (store *Store) EmitEncryptedFile(in sops.Tree) ([]byte, error) {
 		return nil, err
 	}
 	e.SetIndent(indent)
+	if store.config.CompactArrayIndent {
+		e.CompactSeqIndent()
+	}
 	for _, branch := range in.Branches {
 		// Document root
 		var doc = yaml.Node{}
@@ -433,6 +436,9 @@ func (store *Store) EmitPlainFile(branches sops.TreeBranches) ([]byte, error) {
 		return nil, err
 	}
 	e.SetIndent(indent)
+	if store.config.CompactArrayIndent {
+		e.CompactSeqIndent()
+	}
 	for _, branch := range branches {
 		// Document root
 		var doc = yaml.Node{}

stores/yaml/store_test.go

@@ -440,6 +440,107 @@ func TestIndent1(t *testing.T) {
 	assert.Equal(t, INDENT_1_OUT, bytes)
 }
 
+func TestCompactArrayIndent(t *testing.T) {
+	in := []byte(`spec:
+    rules:
+        - host: example.com
+          http:
+              paths:
+                  - path: /api
+                    backend:
+                        serviceName: api
+                  - path: /web
+                    backend:
+                        serviceName: web
+    tags:
+        - production
+        - web
+`)
+	// With default indent (4) and CompactSeqIndent, '- ' is considered
+	// part of the indentation, so arrays are indented by (indent - 2) spaces.
+	expected := []byte(`spec:
+    rules:
+      - host: example.com
+        http:
+            paths:
+              - path: /api
+                backend:
+                    serviceName: api
+              - path: /web
+                backend:
+                    serviceName: web
+    tags:
+      - production
+      - web
+`)
+	branches, err := (&Store{}).LoadPlainFile(in)
+	assert.Nil(t, err)
+	bytes, err := (&Store{
+		config: config.YAMLStoreConfig{
+			CompactArrayIndent: true,
+		},
+	}).EmitPlainFile(branches)
+	assert.Nil(t, err)
+	assert.Equal(t, string(expected), string(bytes))
+}
+
+func TestCompactArrayIndentWithIndent2(t *testing.T) {
+	// With indent 2, compact array indent produces arrays flush with the parent key.
+	in := []byte(`spec:
+  rules:
+    - host: example.com
+      http:
+        paths:
+          - path: /api
+            backend:
+              serviceName: api
+  tags:
+    - production
+    - web
+`)
+	expected := []byte(`spec:
+  rules:
+  - host: example.com
+    http:
+      paths:
+      - path: /api
+        backend:
+          serviceName: api
+  tags:
+  - production
+  - web
+`)
+	branches, err := (&Store{}).LoadPlainFile(in)
+	assert.Nil(t, err)
+	bytes, err := (&Store{
+		config: config.YAMLStoreConfig{
+			Indent:             2,
+			CompactArrayIndent: true,
+		},
+	}).EmitPlainFile(branches)
+	assert.Nil(t, err)
+	assert.Equal(t, string(expected), string(bytes))
+}
+
+func TestCompactArrayIndentDisabled(t *testing.T) {
+	in := []byte(`spec:
+    rules:
+        - host: example.com
+          http:
+            paths:
+                - path: /api
+`)
+	branches, err := (&Store{}).LoadPlainFile(in)
+	assert.Nil(t, err)
+	bytes, err := (&Store{
+		config: config.YAMLStoreConfig{
+			CompactArrayIndent: false,
+		},
+	}).EmitPlainFile(branches)
+	assert.Nil(t, err)
+	assert.Equal(t, string(in), string(bytes))
+}
+
 func TestHasSopsTopLevelKey(t *testing.T) {
 	ok := (&Store{}).HasSopsTopLevelKey(sops.TreeBranch{
 		sops.TreeItem{